Critical Vulnerability in ali-contributors Package
Summary
GHSA-8m5v-f2wp-wqr9: Malicious Package in ali-contributors. Affects ali-contributors versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ali-contributors package is an npm package used for managing contributors in a project. It provides functionality to track and display information about contributors. However, all versions of ali-contributors contain malicious code that uploads system information to a remote server, downloads and executes a file. This package poses a significant security risk to any computer that has it installed or running.
Vulnerability Detail
The vulnerability in ali-contributors is due to the presence of malicious code within the package. When installed or running, the package uploads system information to a remote server controlled by an outside entity. It then downloads and executes a file, potentially giving full control of the computer to the attacker. This can lead to the compromise of sensitive information, such as secrets and keys stored on the affected computer. Removing the package may not guarantee the removal of all malicious software installed as a result of its presence.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to follow the recommended steps to fix the issue and mitigate any potential damage.
Conclusion
The ali-contributors package contains a critical vulnerability that allows for the compromise of affected computers. It is essential to follow the recommended steps to fix the vulnerability and mitigate any potential damage. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ali-contributors →
FAQ
ali-contributors is an npm package used for managing contributors in a project. It provides functionality to track and display information about contributors.
The vulnerability in ali-contributors is manifested through the presence of malicious code within the package. This code uploads system information to a remote server, downloads and executes a file, potentially giving full control of the affected computer to an attacker.
The potential consequences of this vulnerability include the compromise of sensitive information stored on the affected computer, such as secrets and keys. It can also lead to unauthorized access and control of the computer by an outside entity.
While removing the ali-contributors package is recommended, it may not guarantee the removal of all malicious software installed as a result of its presence. A thorough security audit should be conducted to identify any other potential compromises or vulnerabilities.
If you have ali-contributors installed or running, consider the computer as fully compromised. Rotate all secrets and keys stored on the affected computer from a different, secure computer. Remove the ali-contributors package and conduct a thorough security audit.
References
Related vulnerabilities
Recent vulnerabilities recorded for ali-contributors.
